The Eye of The Storm
In a secret, high-tech spy hub near Washington, the war on terror is 24-7
Every weekday at 8 a.m., Kevin Brock hefts a thick white ring binder onto a sleek, oval conference table. Labeled "Read Book," the deceptively plain folder houses the "Threat Matrix," a top-secret compendium of the most troubling reports of possible terrorist activity, drawn from the nation's 16 intelligence agencies. It is thicker than usual on a recent Monday morning, packed with 66 separate items that came in over the weekend. Brock, the principal deputy director of the National Counterterrorism Center, is about to brief some of the government's most senior officials on the latest threat information.
First, though, he must sort through the reports, most of which are vague-and sometimes little more than anonymous tips. Many are false alarms. ("If we could eliminate all the jilted lovers and ex-spouses," Brock says later, cracking a smile, "we would greatly reduce the number of threats we receive on a daily basis.") But some of the nuggets-coming from CIA operatives, FBI sources, or reliable foreign spy agencies-must be taken seriously. Brock, after meeting with the leadership of the counterterrorism center, decided to present 18 of the threat reports at the 8 a.m. videoconference.
Facing a wall of secure video feeds, Brock watches top leaders from a dozen key players gather-the CIA, the FBI, the eavesdroppers at the National Security Agency, even the White House. A briefer from the center, running through the 18 items, discusses possible terrorist action in south Asia, Southeast Asia, the Middle East, even inside the United States. Brock raises the recent release of a videotape showing two of the September 11 hijackers smiling for the camera. He pays particular attention to overseas threats that have a possible domestic angle. "NCTC was created to ... ensure the handshake occurs between international intelligence collection and the FBI or others within the country to take action," says Brock, a career FBI agent. "And we're seeing that take place on almost a daily basis."
"No boundaries." Housed in an unmarked office complex in Northern Virginia, the National Counterterrorism Center has become the centerpiece of reform efforts to integrate the far-flung intelligence community. The NCTC was created in the wake of the September 11 attacks to reduce the gulf between America's spy agencies and domestic law enforcement. With more than 30 separate, highly classified government networks pumping information into NCTC headquarters, it has unfettered access to the crown jewels of the U.S. intelligence community-including raw cables from CIA spies and detailed FBI case files. One congressional staffer with knowledge of intelligence matters calls it a "miracle," only half joking. "We're the only place in the U.S. government where all that information comes together," says retired Vice Adm. Scott Redd, the center's director. "There are no boundaries in this business."
Inside and outside the intelligence world, however, people are still confused about what the two-year-old organization is supposed to do-and what it's not. U.S. News was granted unprecedented access to the senior leadership of the NCTC, which is supposed to become the primary hub for tracking and analyzing the terrorist threat. Director of National Intelligence John Negroponte calls it the single biggest change during his 18 months in office. "The center is really looked to as the principal source of analysis of these kinds of developments," Negroponte tells U.S. News. The NCTC is still building up its ranks, but already it is butting up against the other agencies that work on terrorism, particularly the CIA, which has run its own CounterTerrorism Center since 1986.
The 2004 law that formalized the NCTC also gives it a "strategic operational planning" role, which has taken some time to define. In some ways, it's easier to explain what it isn't. Redd is quick to say that, unlike in the popular TV spy show 24, they don't go after any terrorists themselves. "Jack Bauer doesn't live here," he says.
NCTC officials might not be prowling dark alleyways in Cairo or camping out in Pakistan's lawless borderlands. But the NCTC is, for the first time, trying to make sure that all the operational agencies don't unwittingly trip over one another in the field. "NCTC is not directing operations," says Brock. "We're here just to kind of act as the air traffic controller and make sure everybody is talking." Most of this work is so highly classified that it is difficult to discuss, but Brock tries to describe a recent example in general terms. During the daily 8 a.m. videoconference earlier this year, one intelligence agency announced that it had an imminent opportunity to capture a key terrorist suspect in a Middle Eastern country. Another agency piped up, warning that a productive source of intelligence might be lost if the suspect were nabbed. Brock asked the two agencies to work it out themselves, which they did (although Brock declined to describe how).
Disney-esque. NCTC officials also monitor unfolding plots and investigations, producing continually updated reports called Threat Threads on the most dangerous cases. There are as many as a dozen Threat Threads at any given time; on a recent Monday, the NCTC was tracking 11 different threats. A Thread report came in handy when, for example, the NCTC was coordinating the fast-moving investigation into this summer's alleged plot in Britain to blow up as many as 10 aircraft using liquid explosives. At first, officials had been following the investigation from a distance, because it appeared to be a largely U.K. plot.
But after receiving what officials call "a very specific piece of intelligence" that the suspected plotters were targeting airplanes heading for the United States, the NCTC swung into high gear. Redd was at the White House every day as the investigation built to a climax. At the same time, his aides were helping to coordinate how much information was released to officials at key government agencies, particularly the Department of Homeland Security and its Transportation Security Administration. "They don't need to know what we know about what's going on in Pakistan," says Redd. "But they very much want to know what data we have to be on the lookout for and how does this change our screening procedures."
The NCTC's showpiece is its 24-hour operations center. Designed with input from, among others, Walt Disney's Imagineers, it looks like a film director's version of a high-tech government command post. Giant screens dominate the front of the room, displaying anything from broadcast of an Arab satellite news channel or the radar map over New York City to a highly classified live feed from an armed Predator drone over Afghanistan. An NCTC watch team of at least a dozen people is on duty at all times, while the FBI and the CIA each maintain their own independent terrorism watch centers in the same space. "We are getting paid to say who knows about this information we've just come across, who needs to know about it, and what are they doing about it," says Don Loren, a retired naval officer who runs the operations center.
"Historic baggage." Every watch officer can, in theory, access any piece of counterterrorism intelligence in the entire U.S. government. "We're pretty much the cutting edge," says an air marshal from the TSA assigned to the watch center for the past 18 months. "We're the first ones to see it, and we push it to wherever it needs to go." There are limits, however: To send a piece of raw intelligence from an agency's operational files out to the rest of the community, an NCTC official must first secure the permission of the agency that issued it.
The bulk of the NCTC's work remains on the analysis side. But the road to becoming the hub for U.S. counterterrorism analysis has been rocky. The NCTC (and its predecessor organization, the Terrorist Threat Integration Center) got off to a slow start. "Initially, there was a reluctance on the part of government agencies to let people from other agencies have access to their networks," says John Brennan, who founded the Threat Integration Center and ran the NCTC for its first year. "A lot of people didn't understand what NCTC's mission was."
Getting enough experienced analysts was another problem, and the NCTC had several early tussles over personnel with the CIA's CounterTerrorism Center. Officials insist the wrinkles have largely been ironed out. Negroponte, the director of national intelligence, took the first big step last year when he ordered some 90 CIA analysts to move over to the NCTC. Gen. Michael Hayden's arrival as CIA director (after a stint as the deputy DNI) helped to further cement NCTC's status. Almost immediately, Hayden dispatched an additional 28 analysts to NCTC, and he has pledged to send over 50 more in the next year.
Some critics worry that taking analysts from the CIA could harm the ability of its own CounterTerrorism Center to use analysis to target operations aimed at capturing or killing terrorists. But officials insist that, if anything, the new structure frees up the CIA's center from much of the broader analytical work. "I actually think that NCTC may offer us better opportunities to support all the elements of national power because an awful lot of our activity here, quite legitimately and quite naturally, was focused in on supporting our operations," Hayden tells U.S. News. "We can't take all of America's analytic expertise and hard-wire it to any kill or capture operation. So I was willing to take the risk of shifting some of the weight of our analytic force from here to NCTC." Another factor is the civil liberties concern of giving the CIA, which is barred from domestic spying, access to law enforcement case files. Hayden says that it is better to bridge that gap "in a new location, without any historic baggage to worry about."
This summer, the CIA and the NCTC also agreed to adhere to what officials call "lanes in the road," which lay out who is responsible for reporting on which general areas. It's a tough balancing act, between reducing overlap on one side and ensuring competitive analysis on the other. "The worst thing in the world would be to have one gigantic organization that did all the thinking on counterterrorism for the entire government because the 'groupthink' syndrome comes into play," says Andy Liepman, a career CIA official who now manages the 200 analysts inside the NCTC.
Liepman's most active analysts work in the Al Qaeda and Sunni Affiliates group. One team in the group is dedicated solely to al Qaeda's plotting inside the United States. "Most of the [homeland] plots we believe are credible have in their ancestry an al Qaeda brain," says Liepman. Other groups look at all the other terrorist organizations, as well as their interest in weapons of mass destruction. A fourth tracks the logistical aspects of terrorism, including travel, financing, and communications. "You can't just disrupt the attack," says Redd. "You have to go after every element of that life cycle."
Critics have faulted the NCTC for weak analysis on longer-term strategic topics, such as which factors in Islamic societies help generate more terrorists. Part of it is a staffing problem-there is just so much demand for the tactical work of chasing terrorism suspects. "We have not been able to work the long-term strategic issues to our satisfaction," says Dawn Scalici, a veteran CIA officer who is the deputy director for mission management at the NCTC. "We're stretched pretty thin." Eventually, NCTC officials plan to double the number of analysts. For now, more than half of the 200 analysts have less than three years' experience working on counterterrorism issues. "The fact is that they don't have the culture of analysis that the CIA has built up over decades," says a recently retired intelligence analyst. "They need to develop the analytic tradecraft."
The NCTC's analysts do have one tremendous advantage-wide access to both domestic and foreign raw intelligence traffic. But their physical isolation from the bulk of the CIA's regional and cultural experts could make it more difficult to detect emerging threats. "The analysts are further away from many of the specialists in the intelligence community," says Paul Pillar, a 30-year veteran of the CIA who once served as the deputy chief of its CounterTerrorism Center. "Consultation with them would be essential to help have early warning." Liepman counters that much of that contact is already happening in secure online forums these days. "There is a very good, very healthy, substantive discussion going on now between people who follow Hezbollah and people who follow Iran," he says. "Just because they are not at NCTC or in the counterterrorism community, it doesn't mean they don't have a voice."
The technological challenges have been daunting. When U.S. News visited the Terrorist Threat Integration Center three years ago, then director Brennan had five different computers under his desk to access all the different agencies' networks. That problem remains, and, if anything, is even worse now that the NCTC has even greater access to data. In fact, with more than 30 computer networks wired into the NCTC, analysts in the operations center have to use multiple desks to access them all-the switching equipment they use to toggle between networks can accommodate a maximum of only nine systems. Also, analysts cannot yet search all the networks at the same time with a single command. That technology, says Chief Information Officer Bill Spalding, is still "a couple of years away."
"The fight of a generation." The deluge of information is intimidating. The NCTC maintains the intelligence community's ever expanding central repository of suspected terrorists, called the Terrorist Identities Datamart Environment (which is used to feed several terrorist watch lists, including the TSA's no-fly list). Russ Travers, a career Defense Intelligence Agency official, manages a youthful team of 80 analysts who sort through the mass of reporting on possible terrorist names. Every day, the NCTC receives as many as 2,000 cables-containing some 5,000 to 7,000 names. The database has quadrupled to 400,000 names in three years (although about 100,000 of the names are aliases). Further complicating the task is the fragmentary, often contradictory, nature of the intelligence and the language barrier. "Right away, you run into the whole problem with Arab names," says Travers. "Trying to sort out this 'Mohammed Mohammed' from that 'Mohammed Mohammed' can be a tremendous challenge for these young people."
Perhaps the most ambitious part of the NCTC's mission is its strategic operational planning function. As the "mission manager" for terrorism, the NCTC is supposed to work with the newly created DNI's office, which is charged with reforming the intelligence community, to eliminate gaps in the U.S. counterterrorism effort as well as unnecessary overlap. Without direct command authority, however, the NCTC will have to rely on the DNI's influence over the budget to help push change. It is unclear just how much clout either organization will have.
The NCTC has already issued several plans, including the first National Action Plan to Combat Foreign Fighters in Iraq, completed in June. Officials are now working on another, to counter terrorists' use of the Internet. The most comprehensive effort is the now completed National Implementation Plan, a nearly 200-page document that has become the de facto war plan for the struggle against terrorism. Signed by President Bush in June, the classified plan assigns a lead agency to each of more than 500 different tasks related to the war on terrorism. Some of them are obvious, such as the FBI's lead role in hunting terrorists at home. Others relate to the war of ideas and the need to quell violent Islamic extremism, an area where the State Department has many of the lead roles. The new plan tries to take a broader view, including goals like bolstering educational institutions that focus on Islam and the Muslim world. "This is the fight of a generation," says Vice Adm. Bert Calland, a former deputy CIA director who is now the deputy director for strategic operational planning at the NCTC. "We need to start establishing processes and capabilities with that in mind." Many experts are skeptical; previous efforts by the Bush administration to do outreach to the Muslim world have foundered.
"Radicalization." At the same time, the terrorist threat and the al Qaeda network have become increasingly diffuse. NCTC's analytical director Liepman says that the most credible terrorist plotting appears to have some al Qaeda link back to Pakistan and Afghanistan, but officials are increasingly worried about individual extremists-particularly Muslim men already living here who may be drawn to jihad but who have no ties to known terrorist groups. "In looking at threat reporting on a daily basis, you tend to get a sense of issues of concern and things that might help us understand where radicalization is taking place, why it's taking place, and what we need to be worried about in the future," says principal deputy director Brock. "Radicalization happens in different ways, at different times, with different people, and that's what makes it such a difficult problem."
Redd offers a simple, if unsettling, way to measure their success: "Do the 5-year-olds of today turn into terrorists or do they decide there is something better out there?"
This story appears in the November 6, 2006 print edition of U.S. News & World Report.